Ory

Overview

Ory is a set of open-source identity components rather than a single monolith: Kratos for identity and authentication, Hydra for OAuth2 and OIDC, Keto for Zanzibar-style fine-grained authorization, and Oathkeeper for access proxying. The pieces are API-first and headless, meant to be composed into the exact identity stack a team needs. See the open-source IAM category.

What it is good at

Architecture and authorization are the strengths. The components are well-engineered and fully headless (you build your own UI), and Keto brings Google Zanzibar relationship-based permissions to open source, which few alternatives match. Standards support in Hydra is strong and certified, and the API-first design suits engineering-heavy teams that want to assemble identity precisely rather than accept an opinionated product.

Where it falls short

The trade-off is assembly. There is no bundled admin console or turnkey IdP, so you wire components together, host your own login flows, and operate each service. That frustrates teams wanting an out-of-the-box product. The community is active but smaller than Keycloak's, and some convenience features push you toward Ory Network, the managed offering.

Pricing

Open source and self-hostable at no license cost under Apache 2.0. Ory Network is the managed cloud with a free developer tier and usage-based paid plans, plus enterprise support. Model the build-and-operate cost with the TCO calculator.

Best for, and who should look elsewhere

Choose Ory when you want composable, API-first identity and serious fine-grained authorization, and have the engineering capacity to assemble and operate it. For a turnkey self-hosted IdP, see Keycloak or Authentik; for a modern API-first product with a UI, see Zitadel; for dedicated authorization engines, see the authorization category.

Bottom line

The best open-source choice when you want composable, API-first identity and serious fine-grained authorization. Expect to build the UI and operate the pieces yourself.